using hazop and lopa methodologies to improve safety...

SAFETY SEMINARRio de Janeiro, Brazil - August 3-7, 2009

Using HAZOP and LOPA Methodologies to Using HAZOP and LOPA Methodologies to Improve Safety in the Coke Drums CyclesImprove Safety in the Coke Drums Cycles

Authors:Gil P h M t iGilsa Pacheco Monteiro

Francisco Carlos da Costa BarrosEdson Romano MarinsMarcelo Teixeira HalaszMarcelo Teixeira Halasz

TOPICS

Hazards of DCU Hazards of DCU Batch OperationsBatch Operations

Permissive Permissive Logics MatrixLogics Matrix

Coke Drums Hazard Coke Drums Hazard Evaluation ProcessEvaluation Process

(General View)(General View)

Coke Drum Switching Coke Drums Coke Drums

HAZOPHAZOP StudyStudy

Selecting HAZOP scenarios for

LOPA

Coke Drums Coke Drums LOPALOPA StudyStudy

(Main Results)(Main Results)

Integrated HAZOP and

LOPA Analysis(Main Results)(Main Results)

HAZARDS OF DCU BATCH OPERATIONS

The Coke Drum SwitchingThe Coke Drum SwitchingQuench

Anti-foaming

M

MM

M

M M M M

M

M

M

M

Step Duration (Hours)M M

MM

Filling 20.0

Purge with steam 1.5

Quench 6.0

Condensate

MM

MM

M

MMM

M

M

M

vapor

A B

vapor

Drain 1.5

Unhead 1.0

Decoke 3.0

R h d d T t 2 0

Fractionator HeaterBlowdown

Condensate

Steam

Water

DrainageM

M

MM

The Problem:

Rehead and Test 2.0

Warm-up 5.0

The Problem:“The batch stage of the operation (drum switching and

coke cutting) presents unique hazards and is responsible for most of the serious accidentes attributed to DCUs”.

(US EPA and US OSHA, 2003) Chemical Safety Alert – “Hazards of Delayed Coker Unit (DCU) Operations”


Why does drum switching create unique hazards, resulting in Why does drum switching create unique hazards, resulting in relatively frequent and serious accidents?relatively frequent and serious accidents?

•The batch operations involve a series of opening and closing of valves by the operators;

Risk of operating:

•The wrong valve on the right drum

•The right valve on the wrong drumThe right valve on the wrong drum

(A unit with more than one pair of drums presents even more risks.)

•The high frequency of the drum sequence contributes to increase the likelihood of a human errorerror.

•The inadvertent valve operation can lead to loss of containment scenarios with: release of hydrocarbon from an in-service or

The Goal:The Goal:Improve operator safety Improve operator safety release of hydrocarbon from an in-service or

open drum to atmosphere, fire, release of H2S.

• High operator exposure during

Improve operator safety, Improve operator safety, reducing the risk of loss of reducing the risk of loss of

containmentcontainment!

High operator exposure during drum sequence. How?How?


How to improve safety in How to improve safety in the coke drums cycles?the coke drums cycles?

How to prevent inadvertentHow to prevent inadvertent

•With these logics, some conditions must be met to allow a

How to prevent inadvertent How to prevent inadvertent valve operations during drum valve operations during drum

sequence?sequence?

conditions must be met to allow a valve to be opened or closed. Permissive Logics MatrixPermissive Logics Matrix

•These conditions can be based either on other valves positions or on processother valves positions or on process parameter values (e.g. a permissive logic where the coke drum pressure must be lower than a pre-determined value to allow a valve to open)

• All normally operated sequence valves are automated and the instrumentation

allow a valve to open).

allows to verify valves position.


Th t ibl t b ildPermissive Logics Matrix (PLM)Permissive Logics Matrix (PLM) • The team responsible to build the matrix included: experienced DCU operators, automation specialists and process engineers i l d i th DCU d i dinvolved in the DCU design and operation.

• This matrix was developed

Wh t t p f in id nts th s

during brainstorming sessions.

•What type of incidents these logics can prevent?

•What is the availability or the PFD (Probability to Fail on Demand)

• The starting-point to build this matrix is the set of operational procedures (Probability to Fail on Demand)

acceptable for these logics?

•How safe is enough?

set of operational procedures.

•If the procedures have not been prepared due to the initial design phase, procedures from existent and similar units can be used

HAZOP and LOPA

from existent and similar units can be used as a basis to build the PLM.

COKE DRUMS HAZARD EVALUATION PROCESS – GENERAL VIEW

• This hazard evaluation procedure wasCoke Drums

Permissive Logics Matrix (PLM) Elaboration

Operational

Brainstorming• This hazard evaluation procedure was applied to a Petrobras DCU during Basic Design Phase.

• Preferably the experts responsible for theOperational procedures

Coke Drums HAZOP

(Hazard identification)

• Preferably, the experts responsible for the matrix development integrate the HAZOP team.

• Preferably, HAZOP and LOPA 5 days

Selection of HAZOP scenarios for LOPA

(Consequence severity category assignment =

are performed in an integrated approach, with only one facilitated session.

( q y g y gscenario tolerable frequency definition)

Coke Drums LOPA

• The permissive logics defined in the matrix were assessed using a risk basis through HAZOP;

3 days

Main Results:Main Results:

Coke Drums LOPA

- Initiating event frequency estimation;- Risk gap analysis;- IPLs identification and RRF definition;

D fi iti f SIF ( ith t t SIL) t li i t i k

risk basis through HAZOP;

• The logics that need to be defined as SIF (Safety Instrumented Function) were- Definition of a SIF (with a target SIL) to eliminate risk

gap, if it is not closed yet.Instrumented Function) were identified with a target SIL (Safety Integrity Level).

COKE DRUMS HAZOP STUDY

Understanding HAZOP through the Anatomy of a Understanding HAZOP through the Anatomy of a Process IncidentProcess Incident

Operation Operation ModesModes

NORMALNORMAL ABNORMALABNORMAL EMERGENCYEMERGENCY

All process hazards areAll process hazards areAll process hazards are All process hazards are contained and controlled.contained and controlled.

Key Systems:Key Systems:G lG l1) Primary Containement (pipes & vessels)1) Primary Containement (pipes & vessels)

2) BPCS (Basic Process Control System)2) BPCS (Basic Process Control System)

3) Process Equipment3) Process Equipment

Goals:Goals:

1) Keep the facility in normal 1) Keep the facility in normal operation mode.operation mode.

2) Optimize production2) Optimize production4 Operational Procedures4 Operational Procedures

2) Optimize production.2) Optimize production.


INITIATING INITIATING EVENTEVENT



DEVIATIONDEVIATIONDEVIATIONDEVIATION

(from Normal Op. Mode)(from Normal Op. Mode)


Coke Drum A inlet Coke Drum A inlet feed feed isolation valveisolation valve

inadvertently inadvertently closedclosedduring Filling stepduring Filling step

Overpressure of the Overpressure of the Charge Heater with Charge Heater with potential for loss of potential for loss of

containment and fire.containment and fire.

Loss Event


during Filling stepduring Filling step containment and fire.containment and fire. t



(“No Flow” of Heater effluents)(“No Flow” of Heater effluents)

Goals:Goals:

1) Return to Normal Operation Mode1) Return to Normal Operation Mode

2) If it’s not possible bring the plant to a safe state 2) If it’s not possible bring the plant to a safe state 2) If it s not possible, bring the plant to a safe state 2) If it s not possible, bring the plant to a safe state (shutting down the unit (shutting down the unit before a loss event occursbefore a loss event occurs).).






Loss Event


during Filling stepduring Filling step containment and fire.containment and fire. t


DEVIATIONDEVIATION Goals:Goals:DEVIATIONDEVIATION

(“No Flow” of Heater effluents (“No Flow” of Heater effluents to Coke Drum)to Coke Drum)

Goals:Goals:

The goal changes to The goal changes to the minimization of the minimization of injuries and lossesinjuries and lossesinjuries and losses.injuries and losses.

MITIGATEMITIGATE


INITIATING INITIATING EVENTEVENT

LOSS LOSS EVENTEVENT

HAZOP

PREVENTIVE PREVENTIVE SAFEGUARDSSAFEGUARDS

MITIGATIVE MITIGATIVE SAFEGUARDSSAFEGUARDS

HAZOP Scenari

o



PREVENTIVE SAFEGUARDS: PREVENTIVE SAFEGUARDS: any device, system or any device, system or i h i h h i f f ll ii h i h h i f f ll i

the the likelihoodlikelihood of of f hf haction that can interrupt the chain of events following an action that can interrupt the chain of events following an

initiating cause and prevents the loss event from ensuing.initiating cause and prevents the loss event from ensuing.occurrence of the occurrence of the

loss event.loss event.

MITIGATIVE SAFEGUARDSMITIGATIVE SAFEGUARDS thethe severityseverity ofofMITIGATIVE SAFEGUARDS:MITIGATIVE SAFEGUARDS: the the severityseverity of of consequences.consequences.









containment and fire.containment and fire.LossEvent



DEVIATIONDEVIATION

((““No No FlowFlow”” ofof HeaterHeater effluentseffluents)) Possible safeguards Possible safeguards for this scenario:for this scenario:ff

•Permissive logic that allows the closure of Coke Drum A feed isolation valve only if the Switch valve is turned to Coke Drum B.

•PSV located on Heater outlet, sized for the blocked flow scenario;

H t L L Fl T i•Heater Low Low Flow Trip


•For the switch valve inadvertently switched into a closed inlet isolation valve, some permissive logics were also defined in order to avoid dead-heading the h theater.

F h “NODE”F h “NODE”


For each “NODE”:For each “NODE”:(each step of drum sequence)(each step of drum sequence)

DEVIATIONDEVIATION CAUSECAUSE CONSEQUENCESCONSEQUENCES

High TemperatureHigh Temperature


SAFEGUARDSSAFEGUARDS

D i ti

Parameter Temperature

Hi h

Low TemperatureLow Temperature

High LevelHigh LevelLow LevelLow Level

Deviations

Guide Word More

HighTemperature High PressureHigh Pressure

Low PressureLow Pressure

Guide-Word More

Process Parameter + Guide-Word = DeviationProcess Parameter + Guide-Word = Deviation

High FlowHigh FlowLow FlowLow FlowNo FlowNo FlowReverse FlowReverse FlowContaminationContamination


“ E ” f“ E ” fQuench

Anti-foaming

M

MM

M

M M M M

M

M

M

M

“NODES” Definition:“NODES” Definition:• Each step of the drum sequence is a “NODE”of

l iM M

MM

analysis.

• The node is defined considering the drum and

MA B

gall alignments needed to perform that phase.

• When explaining the design

Condensate

Steam Drainage

M

M

M

MM

M

MM

M

M

M

M

M

M

M

vapor

vapor

• When explaining the design intention of the node, the valves position to perform the step under analysis are

Fractionator HeaterBlowdownWater clearly defined.

Node – Filling Step: from the switch valve, passing through the coke drum, as far g p p g gthe Fractionator, including: the anti-foaming and quench injection lines.


For each “NODE”:For each “NODE”:(each step of drum sequence)(each step of drum sequence)

Qualitative

Approach


SAFEGUARDSSAFEGUARDS

-How safe is enough?

-How many safeguards are needed?

- What is the SIL target required for the SIFs?

LOPALOPA

Semi-Quantitative Approach LOPALOPA

Layer of Protection AnalysisLayer of Protection Analysis

COKE DRUMS LOPA STUDY

The worse the consequence, the lower the The worse the consequence, the lower the tolerance for the incident!tolerance for the incident!

IPL = Independent Protection LayerIPL = Independent Protection LayerPFD = Probability to Fail on DemandPFD = Probability to Fail on Demand

CONSEQUENCE SEVERITY

CATEGORY

How likely the How likely the safeguards will prevent safeguards will prevent

the outcomes?the outcomes?

IPL1IPL1FFTOLERABLETOLERABLE

IPL2IPL2

CAUSECAUSE CONSEQUENCECONSEQUENCE

FFCAUSECAUSE

PFDPFD11 FFSCENARIOSCENARIO

FF <=<= FF

PFDPFD22

How often equipmentHow often equipmentThe IPL provides The IPL provides a Risk Reduction a Risk Reduction FFSCENARIO SCENARIO <= <= FFTOLERABLETOLERABLE

How often equipment How often equipment fails, people err,…fails, people err,… Factor (RRF).Factor (RRF).


CONSEQUENCECONSEQUENCE SEVERITY

CATEGORY = 4

(Fatality within the unit)

FFTOLERABLE = 1 in 10,000 yearsTOLERABLE = 1 in 10,000 years

( y )

Permissive LogicPermissive LogicC k D A i l tC k D A i l tPSVPSV

Permissive LogicPermissive Logic(in the BPCS)(in the BPCS) Overpressure of the Overpressure of the

Charge Heater with Charge Heater with potential for loss of potential for loss of

Coke Drum A inlet Coke Drum A inlet feed isolation valvefeed isolation valve

inadvertently inadvertently closedclosed during during pp

containment and fire.containment and fire.gg

Filling stepFilling step

FFCAUSE = 1 in 10 yearsCAUSE = 1 in 10 years

PFD=0,01PFD=0,01RRF = 100RRF = 100

PFD=0,1PFD=0,1RRF = 10RRF = 10

yearsinPFDFF CauseScenario 000,111

yearsinPFDPFDFF CauseScenario 000,10121



CATEGORY = 4


(Fatality within the unit)

Permissive LogicsPermissive Logics(in the BPCS)(in the BPCS)

Rapid vaporization with Rapid vaporization with potential overpressure potential overpressure

on drum and on drum and

Coke Drum A Coke Drum A Quench Quench Water ValvesWater Valves

inadvertently inadvertently openedopenedFractionator (possible Fractionator (possible loss of containment)loss of containment)

in an in an “in“in--service”drumservice”drum

FFCAUSE = 1 in 10 yearsCAUSE = 1 in 10 yearsPFD=0,1PFD=0,1RRF = 10RRF = 10

• Risk reduction required of two orders of magnitude to

li i t Ri k G !

yearsinPFDFF CauseScenario 10011

eliminate Risk Gap!



CATEGORY = 4SIF = Prevents the drum quench water valve from opening if drum bottom temperature is too high


(Fatality within the unit)temperature is too high.SIL target = SIL 2 (PFD of 0,01)

Permissive LogicsPermissive Logics(in the BPCS)(in the BPCS)

Rapid vaporization with Rapid vaporization with potential overpressure potential overpressure

on drum and on drum and

Coke Drum A Coke Drum A Quench Quench Water ValvesWater Valves

inadvertently inadvertently openedopened

SIFSIF(in the SIS)(in the SIS)

Fractionator (possible Fractionator (possible loss of containment)loss of containment)

in an in an “in“in--service”drumservice”drum

FFCAUSE = 1 in 10 yearsCAUSE = 1 in 10 yearsPFD=0,1PFD=0,1RRF = 10RRF = 10

PFD=0,01PFD=0,01RRF = 100RRF = 100

yearsinPFDPFDFF CauseScenario 000,10121

WHAT DOES SIL MEAN?

What does SIL mean?What does SIL mean?

SIL AVAILABILITY REQUIRED (%)

PFD(Probability to fail

RRF = 1/PFD(Risk ReductionREQUIRED (%) (Probability to fail

on demand)(Risk Reduction

Factor)

1 90,00 - 99,00 0,01 – 0,1 100 – 102 99 00 99 90 0 001 0 01 1000 1002 99,00 - 99,90 0,001 – 0,01 1000 – 100

3 99,90 – 99,99 0,0001 – 0,001 10.000 - 10004 > 99,99 0,00001 – 0,0001 100.000 – 10.000, , ,

The SIL (Safety Integrity Level) indicates the availability or the PFD of a SIF (Safety Instrumented Function) when a process demand occurs.

E.g.: The acceptance of a SIL 1 means that the risk is sufficiently low that a function with an availability of 90% (or

PFD

PFDAvg

y (10% chance of failure) is acceptable.

TimeTI TI TI

WHAT DOES SIL MEAN?

When is SIS used?When is SIS used?A SIS (Safety Instrumented System) is a combination of sensors, logic solvers and final elements that performs one or more safety instrumented functionsy(SIFs), which are installed for the purpose of mitigating the hazard or bringing the process to a safe state in the event of a process upset.

(*) The SIS is used for any process in which the process hazard analysis has( ) The SIS is used for any process in which the process hazard analysis has determined that the mechanical integrity of the process equipment, the process control, and other protective equipment are insufficient to mitigate the process hazard.

SISs are covered by:

IEC 61511 – Functional Safety: Safety Instrumented Systems for the Process Industry Sector

ANSI/ISA 84 00 01 2004 (IEC 61511 difi d)ANSI/ISA 84.00.01-2004 (IEC 61511 modified)

ISA TR84.00.04.04 – 2005 – Guidelines for the Implementation of ANSI/ISA 84.00.01-2004 (IEC 61511 modified)

(*) Summers, A. (1998), “Techniques for assigning a target safety integrity level”, ISA Transactions 37 (1998) 95 – 104.

SELECTING HAZOP SCENARIOS FOR LOPA

Do I have to apply LOPA to all HAZOP scenarios?Do I have to apply LOPA to all HAZOP scenarios?

• One way to define the events of interest for LOPA is to determine the scenarios that result in release of

When to move When to move beyond beyond

qualitative risk qualitative risk

determine the scenarios that result in release of hydrocarbon and H2S from an in-service or open drum during switch and unheading.

qualitative risk qualitative risk judgment?judgment?Operating Mode Initiating Events

- Vent valve opening- Drain valve openingI S i

• Besides this list, Petrobras Coke drums analysis identified some

Drain valve opening- Top head opening- Bottom head opening- Overhead to Fractionator valve opening Inlet feed valve opening

In-Service

Zachary, B. 2005. Applying SIS Standards to Coker Processes, 10th Annual

yother initiating events, not necessarily directly related to hydrocarbon relase to atmosphere.

- Inlet feed valve opening- Blowdown valve opening- Condensate Vessel valves opening

Open Drum

Zachary, B. 2005. Applying SIS Standards to Coker Processes, 10 Annual Universal Delayed Coking Seminar, Long Beach, CA, August 1-3, 2005.

p


Oth I iti ti E t Id tifi d ith P t b C k Oth I iti ti E t Id tifi d ith P t b C k Other Initiating Events Identified with Petrobras Coke Other Initiating Events Identified with Petrobras Coke Drums AnalysisDrums Analysis

Quench water valve opening to an in service drum (leading to a coke drum- Quench water valve opening to an in-service-drum (leading to a coke drum overpressure due to the rapid water vaporization, with potential for loss of containment, hydrocarbon leakage and equipment damage);

- Coke drum inlet feed valve closing (with potential overpressure to the upstreamCoke drum inlet feed valve closing (with potential overpressure to the upstream segment, which includes the heater; loss of containment, fire and equipment damage);

- Switch feed valve inadvertently turned to a blocked segment (out-of service drum y g (“B” or coke drums by-pass line to fractionation tower);

- Coke drum to Fractionator valve closing in an in-service drum (with potential drum overpressure);

- Coke drum to Blowdown valve opening in an in-service drum (with potential Blowdown System overpressure);


Other Initiating Events Identified with Petrobras Coke Other Initiating Events Identified with Petrobras Coke Drums AnalysisDrums Analysis

- coke cutting operational error, raising the drilling stem out of the drum (potentially exposing the operator to high pressure water jet);

- out-of-service coke drum safety relief valve leaking (with potential hydrocarbon l t th t h f th f ti ti t hi h thi li f lrelease to the atmosphere from the fractionation tower, which this relief valve

discharge is aligned to).- high pressure drilling water delivery hose failure;

•A similar solution was recommended d i HAZOP t th t hduring HAZOP to the water hose disconnection or rupture scenario.


Do I have to apply LOPA to all HAZOP scenarios?Do I have to apply LOPA to all HAZOP scenarios?

Qualitative Study(E.g.: HAZOP scenario) LOPA(E.g.: HAZOP scenario)

Is consequence severity >

III?Is frequency

Yes When to move When to move beyond beyond

qualitative risk qualitative risk

Is consequence severity >

III?Is frequency

of consequenc

e > 1/10 years?

No Yes

Yes

qqjudgment?judgment?

yIs a SIL

required for one or more

SIFs?

No

Complete Study based on qualitative

judgment

No(*)Adapted from CCPS / AIChE (Layer of Protection Analysis –Simplified Process Risk Assessment, page 159, 2001).


Other ResultsOther Results

Typical scenario when there are multiple coke drums with its PSVs

Possible backflow of blowdown (or fractionator) vapors to an open drummultiple coke drums with its PSVs

discharge aligned to Blowdown system or to Fractionator.

fractionator) vapors to an open drum, leading to release of hydrocarbons /

H2S with potential fire.

Other design alternative: gmotorized block valves located on the discharge of the coke

drum PSVs


Integrated HAZOP and LOPA/SIL AnalysisIntegrated HAZOP and LOPA/SIL Analysis

Only one facilitated session is required and only one

The integrated approach is less time consuming and more consistent, since is required and only one

database is generated.g ,

the HAZOP and LOPA teams are the same.

Using HAZOP and LOPA Methodologies to Improve Safety in the Coke Drums Cycles

ConclusionsConclusions

•“No one system has proven effective in eliminating all incidents associated with incorrect valve activation due to mistaken coke drum operation.”

(US EPA and US OSHA, 2003) Chemical Safety Alert – “Hazards of Delayed Coker Unit (DCU) Operations”

•However, the definition of a set of permissive logics that prevent inadvertent valve operations during the coke drums batch steps has been an improvement adopted by some refiners. The set of logics are defined based on operational procedures, during brainstorming sessions involving a multidisciplinary team.brainstorming sessions involving a multidisciplinary team.

•HAZOP and LOPA methodologies can provide a risk decision basis to assess the set of permissive logics, defining what accident scenarios these logics can prevent, the amount of risk reduction needed to achieve a scenario tolerable frequency of occurence andof risk reduction needed to achieve a scenario tolerable frequency of occurence and the availability or SIL required for those logics which will be defined as SIFs.

•The integrated HAZOP and LOPA Analysis is presented as a more consistent and less time consuming approachconsuming approach.

using hazop and lopa methodologies to improve safety...

Documents